Every check

Whether https:// answers, without a loop or a redirect somewhere unsafe.

Whether http:// sends visitors to https://, permanently.

Whether any redirect goes from https:// back to http://.

The Strict-Transport-Security header, and whether it lasts a year.

Whether both example.com and www.example.com answer over HTTPS, and lead to the same address.

The newest certificate for the site in Certificate Transparency logs, and how much of its life is left: flagged with under a quarter, or 14 days.

Whether Cloudflare answered with a bot challenge instead of the site.

The Content-Security-Policy header, and whether it limits scripts.

CSP frame-ancestors, or X-Frame-Options.

X-Content-Type-Options: nosniff.

Referrer-Policy, for values that leak full addresses.

Server, X-Powered-By and similar headers, for version numbers.

The versions in the Server and X-Powered-By headers and the generator tag: PHP, Apache, nginx, IIS, OpenSSL and Drupal.

Whether the home page echoes another site's Origin in Access-Control-Allow-Origin, with credentials.

The Permissions-Policy header.

The Cross-Origin-Opener-Policy header.

Whether each cookie the home page sets has Secure.

Whether session-like cookies have HttpOnly.

Whether each cookie the home page sets has SameSite.

Files the home page loads over http://.

Forms on the home page that post to http://.

Versions of jQuery, jQuery UI, Bootstrap, AngularJS, Lodash and Moment.js named in script addresses.

Scripts and stylesheets from public CDNs without an integrity hash.

A generator meta tag that names a version.

The hosts the home page loads scripts from: whether each still exists, and whether it's one of the polyfill.io network's.

Whether the domain resolves to an address inside a private network.

Whether the domain has an AAAA record.

Whether answers about the domain validate with DNSSEC.

CAA records at the name or above it.

When the domain's registration ends, from its registry over RDAP: flagged within a month, and urgently within a week.

Whether the registry shows the domain locked against transfer (clientTransferProhibited), for generic TLDs such as .com, whose registries all keep the status.

Whether the host's CNAME points at a name that doesn't exist, or at a GitHub Pages, Heroku, S3, Azure, Netlify or similar name no one has claimed.

Up to 25 subdomains named in Certificate Transparency logs: whether any has a CNAME to a name that no longer exists, or to a service that says no one has claimed it.

The SPF record: just one, ending in ~all or -all.

How many DNS lookups checking the SPF record takes, its includes followed down, and whether each include has an SPF record.

The DMARC record and its policy.

An MTA-STS record, where the domain takes email.

A TLS-RPT record at _smtp._tls, for a domain that takes email.

Whether each server the MX records name resolves.

DKIM keys under the selectors most providers use: google, selector1, selector2, k1 and others.

/.well-known/security.txt with a Contact line, not expired.

49 well-known paths that shouldn't be public, from /.git/HEAD to /.env.

The site's own scripts, for live keys: Stripe secret key, AWS access key, GitHub token, Slack token, Slack webhook, SendGrid key, OpenAI key, Anthropic key, Private key.

/.git/HEAD, /.git/config

/.env, /.env.local, /.env.production

/wp-config.php.bak, /wp-config.php~, /wp-config.php.save, /wp-config.php.old

/backup.sql, /dump.sql, /database.sql, /db.sql

/.aws/credentials, /.npmrc

/.ssh/id_rsa, /id_rsa

/.vscode/sftp.json, /sftp-config.json

/actuator/env

/terraform.tfstate

/.git-credentials

/.kube/config

/phpinfo.php, /info.php

/_profiler/, /telescope/requests

/.svn/wc.db, /.hg/requires

/backup.zip, /site.zip, /backup.tar.gz

/.htpasswd

/wp-content/debug.log, /error_log

/storage/logs/laravel.log

/elmah.axd

/phpmyadmin/, /phpMyAdmin/, /adminer.php

/server-status

/debug/pprof/

/docker-compose.yml

/uploads/, /wp-content/uploads/, /backup/, /files/

/.DS_Store

/wp-json/wp/v2/users

What Shodan's InternetDB, from its weekly scans, has seen open on up to four of the site's addresses: databases, remote access and container APIs, and the known flaws it lists.

Ports 6379 (Redis), 27017 (MongoDB), 9200 (Elasticsearch), 5984 (CouchDB), 11211 (Memcached), 3306 (MySQL), 5432 (PostgreSQL), 1433 (SQL Server), 1521 (Oracle), 9300 (Elasticsearch nodes), 9042 (Cassandra), 8086 (InfluxDB), 7474 (Neo4j), 5672 (RabbitMQ), 9092 (Kafka), 2181 (ZooKeeper).

Ports 3389 (Remote Desktop), 5900 (VNC), 5901 (VNC), 23 (Telnet), 445 (Windows file sharing), 5985 (WinRM), 5986 (WinRM), 139 (NetBIOS), 21 (FTP).

Ports 2375 (Docker), 2379 (etcd), 10250 (Kubelet), 10255 (Kubelet read-only), 2376 (Docker over TLS), 6443 (Kubernetes).

The CVEs Shodan's InternetDB matched to the software versions the site's addresses announce.

Whether Google Safe Browsing lists the home page, or the site's own pages it links to, as malware, phishing, unwanted software or harmful apps. Advisory provided by Google.

The home page's first 512 KB against the HTML standard, as the Nu Html Checker does.

Whether the home page comes back with gzip or Brotli when asked for them.

Scripts in the head without async, defer or type="module".

Images without both width and height attributes.

Whether a page with six or more images loads any of them lazily.

The size of the home page's HTML, over 300 KB.

How many redirects https:// takes to reach the home page.

The Cache-Control and Expires headers on the site's own scripts.

Whether the page has a <title>, under 65 characters.

Whether the page has a meta description.

A robots meta tag or X-Robots-Tag header saying noindex on the home page.

Whether robots.txt says Disallow: / to every user agent.

A Sitemap line in robots.txt, or /sitemap.xml.

Whether the page has an h1.

A canonical link, and whether it points at this site.

The status a page that doesn't exist answers with.

og:title, og:description and og:image.

A twitter:card meta tag.

JSON-LD blocks, and whether they parse.

A link rel="icon" or rel="apple-touch-icon" in the page.

A lang attribute on the html element.

Images on the home page without an alt attribute.

A viewport meta tag with user-scalable=no, or a maximum-scale under 2.

Form fields with no label, aria-label, aria-labelledby or title.

A viewport meta tag.

Whether heading levels skip, such as an h2 followed by an h4.

Links with no words, no aria-label and no image with alt text inside.

Buttons with no words and no aria-label.

Links whose words are only "click here", "read more" or the like.

Iframes without a title.

The page's paragraphs and lists: Flesch reading ease and grade for English, LIX for other languages.

Scripts on the home page from known analytics and advertising trackers.

A Markdown /llms.txt.

What robots.txt says to GPTBot, ClaudeBot, Google-Extended, CCBot and other AI crawlers, and any Content-Signal line.

Up to ten of the home page's links to the site's own pages, and whether each answers without a 404, 410 or server error.